Thanks for the reply. I have a few more questions, if you'll bear with me.
You mentioned "smtpd_reject_unlisted_recipients" but the file has "smtpd_reject_unlisted_recipient". I tried it with and without the trailing "s" but I'm still getting messages in my Active queue with a receiver address that's not valid on our system. (I didn't forget the postfix reload, either.)
I noticed the command I posted above from the manual included three of the six checkboxes from the Global Settings->MTA page. Specifically, it had the Protocol checks, but not the DNS checks. Is it valid to add the three DNS checks to the command so it looks like this? Or do they belong to something other than zimbraMtaRestriction?
The command listed in the Admin Guide is under the statement, "To add all the possible restrictions," so if the other three can be included, should I file this as a documentation issue? Note that there is already a minor documentation issue that could be added because the command in the doc uses publishers' left and right quotes instead of regular (shell) quotes, so when you paste the command it doesn't work right.
zmprov mcf zimbraMtaRestriction reject_invalid_hostname \
zimbraMtaRestriction reject_non_fqdn_hostname \
zimbraMtaRestriction reject_non_fqdn_sender \
zimbraMtaRestriction reject_unknown_client \
zimbraMtaRestriction reject_unknown_hostname \
zimbraMtaRestriction reject_unknown_sender_domain \
zimbraMtaRestriction "reject_rbl_client dnsbl.njabl.org" \
zimbraMtaRestriction "reject_rbl_client cbl.abuseat.org" \
zimbraMtaRestriction "reject_rbl_client bl.spamcop.net" \
zimbraMtaRestriction "reject_rbl_client dnsbl.sorbs.net" \
zimbraMtaRestriction "reject_rbl_client sbl.spamhaus.org" \
zimbraMtaRestriction "reject_rbl_client relays.mail-abuse.org"
I'm not seeing any difference in the output of "zmprov gacf" or "postconf" when I check or uncheck the Global->MTA Protocol & DNS checks. I was concerned because they keep becoming unchecked. Are they just not valid anymore once you've done a "zmprov mcf zimbraMtaRestriction" command?